At 8:30 am on the second floor of Paydee Sdn Bhd, I met with Ms. Shevaun, Paydee's Human Resources representative, to begin my onboarding process as a Compliance Trainee. The session was designed to guide me before I officially started my training.

Contract Signing and Policy Review

During the initial session, I signed several documents to formalize my contract with Paydee under Advance Synergy Berhad. These documents included:

• Salary Policy: Outlining the terms of compensation.

• Whistleblower Form: Providing a secure channel for reporting any unethical practices.

• Company Policies: Detailing various rules and guidelines applicable to all workforce members.

  
  

Briefing on Paydee

Ms. Shevaun briefed me on Paydee's mission, vision, objectives, organizational structure, work ethic, and corporate culture. This briefing was intended to equip me with the necessary knowledge to align my efforts and commitment with Paydee's goals, ensuring I can effectively contribute to its future success.

Office Tour and Introductions

The onboarding process included a tour of the Paydee office, from the ground floor to level 1, where I was introduced to other colleagues during a welcoming session.

Meeting with Supervisor

I had a brief meeting with my supervisor, Tan Pei Ru, who asked about my initial impressions and provided a general overview of my role within the company. I also requested that she sign several documents required by Universiti Utara Malaysia (UUM) for my internship. These documents included the Report Duty Form, I Form, and Employer's Confidential Assessment Form. I prepared them according to UUM's guidelines and had Tan Pei Ru sign them.

I received a detailed handover of my tasks from Nazurah, a Compliance Officer. This handover helped me understand my responsibilities during the internship, including the workflow, deadlines, and how to collaborate with other departments to ensure compliance tasks are completed smoothly. Nazurah provided all the necessary documents and explained what was expected of me.

During the briefing, Nazurah outlined my main tasks. These included reviewing policies from Visa, Mastercard, and Bank Negara Malaysia (BNM), and ensuring all departments comply with these policies and submit the required reports. I was also assigned to conduct Customer Due Diligence (CDD) and to learn about the Anti-Money Laundering (AML) and Counter Financing of Terrorism (CFT) Act, as well as the Personal Data Protection Act (PDPA). Additionally, I was tasked with handling the compliance requirements for Qurex Sdn Bhd, a subsidiary of Advance Synergy Berhad (ASB).

During my training, Nazurah guided me on how to create lists and summarize publications from Visa, Mastercard, and BNM. She also showed me the location of the shareholder file within the Compliance Department and instructed me on how to access several key tools and websites, including Visa Access, MasterCard Connect, Kijang Net, and Money Pro. This training will support me in fulfilling my responsibilities as a Compliance Trainee.

Today, I focused on enhancing my knowledge by studying the slides and guidelines provided by the Compliance Department under the guidance of Nazurah, a Compliance Officer. These resources covered key compliance regulations relevant to the financial sector in Malaysia. Specifically, I studied the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act (AMLA) 2001, proliferation risks, the Personal Data Protection Act (PDPA), and other compliance acts.

Anti-Money Laundering and Anti-Terrorism Financing Act (AMLAATFA) 2001

I reviewed the main laws governing anti-money laundering and counter-terrorism financing in Malaysia. The AMLA 2001 is crucial for preventing money laundering and terrorism financing by requiring financial institutions and certain businesses to detect, report, and prevent illegal activities. Key components include customer due diligence, reporting suspicious transactions, and record-keeping. This Act applies broadly to individuals, businesses, and financial institutions, aiming to maintain the integrity and stability of Malaysia's financial system.

National Risk Assessment (NRA)

I also learned about the National Risk Assessment (NRA), which is a centralized evaluation conducted by Malaysia's National Coordination Committee to Counter Money Laundering (NCC). The NRA 2023 is the fifth iteration of this assessment and is designed to identify and assess Malaysia's exposure to money laundering and terrorism financing risks. It includes two primary assessments: the Threat Risk Assessment, which analyzes serious crimes that generate illicit proceeds (such as fraud, corruption, and organized crime), and the Sectoral Risk Assessment, which evaluates the vulnerability of various financial and non-financial sectors. Sectors like banking, jewelry (DPMS), and legal services are considered high-risk due to their nature and exposure to these activities. The findings from the NRA guide national and institutional AML/CFT policies and measures, helping reporting institutions assess and mitigate risks effectively.

Personal Data Protection Act (PDPA)

I also studied the PDPA, which regulates how personal data is used in business transactions. The Act aims to protect individuals' privacy by setting rules for how data is collected, used, shared, and stored. The PDPA applies to organizations, including banks, that handle personal data in commercial transactions. Recent amendments have enhanced its provisions to align with international standards.

In the morning, I set up access to crucial tools and platforms essential for my role as a Compliance Trainee, with assistance from my mentor, Nazurah. These included:

• Visa Access: This platform provides access to Visa's guidelines, publications, and requirements. It is vital for ensuring compliance with Visa's regulations and for staying updated on any changes or new directives.

• MasterCard Connect: Similar to Visa Access, MasterCard Connect offers insights into MasterCard's compliance requirements, bulletins, and guidelines. It helps me stay informed about MasterCard's policies and procedures.

• Kijang Net by BNM: Kijang Net is a platform provided by Bank Negara Malaysia (BNM) for financial institutions to manage and submit reports related to anti-money laundering and counter-terrorism financing. Accessing this platform allows me to understand the reporting requirements and ensure compliance with BNM's regulations.

Mastering Microsoft Outlook

In the morning, I also learned how to effectively use Microsoft Outlook 2007 for corporate communication. This included setting up email templates using "Quick Parts," organizing my inbox with folders and rules, and scheduling emails for future delivery. These skills are crucial for maintaining professional communication and facilitating interdepartmental correspondence within Paydee Sdn Bhd and with business partners.

Understanding the Kijang Net Reporting System

In the afternoon, I gained insight into the Operational Risk Reporting (ORR) system accessible via Kijang Net, which is used for submitting reports to Bank Negara Malaysia. The ORR system involves three Key Risk Indicators (KRIs) and requires reports to be submitted monthly, quarterly, semi-annually, and annually, with additional reports for unexpected risks or events.

Today, I focused on learning about Customer Due Diligence (CDD) under the guidance of Nazurah, a Compliance Officer at Paydee. CDD is a critical process used by financial institutions to verify the identity of customers and assess their risk profiles, which is essential for preventing money laundering, terrorism financing, and other illicit activities.

Understanding the CDD Process

Nazurah guided me through the main steps involved in conducting CDD:

• Identifying the Customer: The first step is to gather and verify the customer’s identity by collecting identification documents such as NRIC/passports, E-SSM Certificate, Schedule 1, CTOS information, bank statements, and by checking public records.

• Verifying the Customer’s Identity: After collecting the necessary documents, the customer’s identity must be verified using reliable, independent sources. This includes checking against sanctions lists and public databases such as the OFAC Sanction List, United Nations Sanction List, and Bank Negara Malaysia (BNM) Sanction List.

• Assessing the Customer’s Risk Profile: Once the customer’s identity is verified, their risk profile is assessed based on factors like business activities, financial history, and geographical location. This helps determine whether standard, simplified, or enhanced due diligence is required.

• Collecting Additional Information: Depending on the customer’s risk profile, further information and supporting documents may be required, such as financial statements, business licenses, or photographs of business premises.

• Ongoing Monitoring: Customers are subject to ongoing monitoring to detect any suspicious activities or changes in their risk profile. This ensures that any unusual transactions or activities are promptly identified and reported.

  
  

Sanction List Checks in CDD

As part of the CDD process, I learned about the importance of checking customers against sanction lists. This involves verifying if customers are listed on databases such as the Office of Foreign Assets Control (OFAC), the Specially Designated Nationals (SDN) list, the Ministry of Home Affairs (MOHA) Sanction List, the Politically Exposed Persons (PEP) List, and Bank Negara Malaysia’s (BNM) own lists. These checks are crucial for ensuring compliance with international and local regulations and for preventing transactions with sanctioned entities.

Applying CDD at Paydee

At Paydee, CDD is applied by analyzing the Schedule 1 form, which is required for customers seeking our services. This involves comparing the customer’s supporting documents with other proofs of eligibility, such as information from CTOS and SSM. These checks ensure that customers are legitimate and compliant with regulatory requirements.

Nazurah explained how these procedures help prevent fraudulent activities and maintain compliance with anti-money laundering regulations. By understanding the CDD process, I gained insight into how Paydee ensures the integrity of its customer base and adheres to regulatory standards.

CDD (New Merchant List of February 2025)

As part of my ongoing tasks as a Compliance Trainee, I focused on completing the Customer Due Diligence (CDD) process for a list of new merchants from March 2025, which was collected by the Merchant Risk Department. I reviewed 10 new merchants and provided feedback in the comment section, highlighting areas that needed improvement. These included correcting typos in business owner and company names, as well as requesting additional or higher-quality supporting documents to ensure compliance with regulatory requirements.

Paydee is required to submit second half March 2025 Data Breach Incident Report to Bank Negara Malaysia (BNM) by 30th of every month for second half of the month. The input for this report is collected from the Transaction Risk Department several days before the submission date for proper arrangement. After compiling the required information, I submit the report to BNM via email, following the report format provided by BNM.

Part 1: Visa Bulletin Review (March 2025)

In the morning, I began preparing the Visa bulletin review on behalf of Paydee. The first step was to extract all publications labeled "Global (GLB)" and "Asia-Pacific (AP)" from the Visa bulletin up to March 17, 2025. I have summarized 12 bulletins so far in which 10 applicable and 2 non-applicable bulletins. While making the summaries, I ensured that all relevant information was accurately recorded in the Excel file. This material will be circulated to the relevant departments so they can take any necessary actions or implement mandates required by Visa.

Part 2: Visa Bulletin Review (March 2025):

In the afternoon, I continued preparing the remaining Visa bulletin reviews on behalf of Paydee. I extracted all bulletins labeled "Global (GLB)" and "Asia-Pacific (AP)" from the Visa bulletin up to March 18, 2025, and saved them in the shared folder named "Compliance Bulletin Review". I was summarized 8 applicable bulletins.

I reviewed and analyzed MasterCard bulletins published in March 2025 to identify any amendments or information requiring further action. I selected bulletins labeled "Asia Pacific (AP)" or "Global (GLB)" due to their relevance to Paydee as a merchant acquirer and credit card issuer in Malaysia. I reviewed 14 applicable bulletins and 5 non-applicable ones. After summarizing the key points, I recorded the information in an Excel file and circulated both the summary and the original bulletin files to all relevant departments at Paydee via Outlook 2007 email.

Translating Paydee New Merchant Application Form:

Ms. Tan Pei Ru assigned me the task of assisting her in translating several forms from English to Malay. These forms included the Paydee Feedback Form, Paydee Visa Dispute Form, and Paydee Visa Maintenance Form. Once I completed the translations, I submitted the documents to her via Outlook 2007 email.

I continued the bulletin review and summary process for MasterCard by extracting all remaining publications from the MasterCard Connect website and saving them in the shared folder as references. Today, I completed summaries for 18 articles, 15 of which are applicable and 3 non-applicable, ensuring each was accurately documented in the Excel file and that I fully understood the content of every reviewed article.

Completing Opt-Out MasterCard Services:

MasterCard offered Paydee several automatically enrolled services, which are optional for Paydee to continue or opt out of. After obtaining prior consent from the relevant persons in charge (PIC) of Paydee operations, Paydee decided to opt out of the following three programs:

• Cards Lab

• Portfolio Advisor

• Acquisition Benchmarking Report

As a Compliance Intern, I was tasked by Ms. Tan Pei Ru to manage and complete the opt-out process for all previously listed services. I ensured the opt-out requests were submitted according to MasterCard's procedures and maintained records of the process for compliance purposes.

Track and Record Evidence of Paydee Team Report (March 2025):

As a Compliance Intern, I am also responsible for tracking and recording all report submissions to BNM (ORR), Visa, MasterCard, and other relevant parties. I documented proof of submission throughout March 2025 in the previously prepared Excel file, including details such as the date, type of report, and any required follow-up actions. In total, I recorded 30 report submissions for March 2025 to ensure clear documentation and prevent any misunderstandings.

Paydee has received the Policy Document on Complaints Handling issued by Bank Negara Malaysia (BNM) on 28 March 2025 through the BNM KijangNet website. This document communicates the results of the "Feedback Statement on the Exposure Draft on Complaints Handling" and outlines BNM’s expectations for Financial Service Providers (FSPs) and Approved Persons (APs) to implement robust mechanisms and transparent methods for handling consumer complaints. The goal is to enhance consumer trust and satisfaction by ensuring effective resolution processes.

To fully understand the Policy Document, my supervisor, Ms. Pei Ru, assigned me to research the Financial Ombudsman Market Services (FMOS), a critical component for interpreting the document’s requirements. After completing the research, I submitted the FMOS findings to Ms. Pei Ru and incorporated her revisions before finalizing the summary for circulation.

Qurex Sdn Bhd, a subsidiary of Advance Synergy Berhad (ASB), specializes in merchant trade, money exchange, and remittance services to specific countries. As Qurex operates under ASB, Paydee staff also manage Qurex’s business operations and administrative tasks, including shared compliance department responsibilities.

As a compliance intern, my responsibilities include conducting Anti-Money Laundering/Counter Financing of Terrorism (AML/CFT) processes. During my visit to Qurex’s office today, I reviewed customer transactions to identify any suspicious activity. For March 2025, no suspicious transactions were detected, as most customers were regular clients conducting remittances (e.g., to Indonesia). I documented the evidence for both monthly and quarterly reporting purposes.

Part 3: Visa Bulletin Review (March 2025)

I reviewed 6 applicable and 3 non-applicable Visa bulletins from March 2025, carefully reading through each to identify the most important information. I summarized the key points, such as updates on payment rules, alerts about suspicious cards, and changes in procedures. Afterward, I organized the summaries based on their urgency and relevance to our operations. Finally, I shared these summaries with the relevant teams in the company to ensure everyone stays informed and can take any necessary actions. This process helps ensure that we remain up to date and compliant with Mastercard’s guidelines.

CDD (New Merchant List of February 2025)

Today, I continued working on the remaining merchants around 7 new merchant from the February 2025 list as part of the Customer Due Diligence (CDD) process. I reviewed each merchant’s documentation to ensure compliance with regulatory requirements. This involved checking for the accuracy of business owner names, company names, and verifying the quality of supporting documents. Where necessary, I added comments to highlight areas needing improvement or to request additional information.

Sanction List Checking (New Merchant List of February 2025):

I conducted checks against various sanction lists to ensure compliance. This included verifying the merchants and their personnel against lists from OFAC, the United Nations, BNM-FCA, MOHA, and PEP. These checks are crucial for preventing transactions with sanctioned entities, maintaining the integrity of financial systems, and ensuring that no financial crimes or illicit funds are processed.

I have completed the review of the Policy Document on Complaints Handling published by Bank Negara Malaysia (BNM) and ensured Paydee fully understands and complies with the guidelines. The review was finalized, and an email confirmation was sent to my supervisor.

The Policy Document, issued on 28 March 2025, sets out enhanced regulatory requirements for Financial Service Providers (FSPs) and Approved Persons (APs) to establish robust, fair, and transparent complaints-handling mechanisms. These requirements aim to promote timely and effective resolution of consumer complaints, strengthen consumer trust, and align with evolving expectations in the financial services sector.

Paydee is subject to these requirements due to its status as an Approved Person (AP) under BNM regulations. The next steps involve aligning Paydee’s internal guidelines and procedures with the new policy to ensure compliance and readiness for the policy’s effective date on 1 April 2026, with certain provisions already in effect as of 28 March 2025.

Circulating the Mastercard and Visa Bulletin Review Summary (March 2025)

In March 2025, I reviewed a total of 43 Mastercard and 24 Visa bulletins relevant to Paydee’s operations. Summaries of these bulletins were prepared and circulated to all related departments within Paydee Sdn Bhd to ensure awareness of the latest updates and necessary compliance actions.

I received an email from the Product Operations Department containing the list of high-risk merchants for Q1 2025 (January–March 2025) and the list of active transaction merchants. My main task is to conduct ongoing CDD on the high-risk merchants by cross-checking their documents, such as the latest E-SSM Certification, CTOS, and registration documents. This is to ensure that there are no fraudulent activities, as required by the Compliance Officer.

Research of Financial Market Omburdsman Services (FMOS) Jurisdiction:

My supervisor, Ms. Tan Pei Ru, assigned me to conduct research to increase understanding of the main scope and types of services provided by FMOS based on its jurisdiction for resolving related disputes. Based on my research, FMOS was established by the government to ensure that complaints from complainants are handled according to guidelines, providing independent, fair, and free dispute resolution services to financial consumers and investors who are unable to resolve their financial complaints with Financial Service Providers (FSPs) or capital market intermediaries in Malaysia. FMOS operates under several acts, including the Financial Services Act 2013, Islamic Financial Services Act 2013, Development Financial Institutions Act 2002, and Capital Markets and Services Act 2007. Not all disputes are processed by FMOS, cases must meet eligibility and criteria to be considered. I also provided information on the process, example cases, and definitions of unfamiliar terms to increase awareness.

Hari Raya Aidilfirtri Celebration

Paydee informed us that ASB Berhad, as Paydee’s parent company, together with Paydee and its other subsidiaries, would hold a Hari Raya Aidilfitri celebration on 9 April 2025 to appreciate all staff, both Muslim and non-Muslim. The event was held at Level M below Paydee’s main office. Around 150 people attended the event, which helped relieve work-related stress. At the event, various types of Malaysian food commonly served during Hari Raya, such as Nasi Himpit, Ayam Rendang, Kuah Kacang, and Nasi Hujan Panas, were provided. The event, organized by the Human Resources Department, also featured two performances: a dance and a singing performance.

Part 2: FMOS Research

I continued the research by making revisions based on the input received. I have attached all references for the reader’s further perusal to ensure the highest level of understanding and clarity. Thereafter, I circulated the research to my supervisor to ensure her review as the Manager of the Compliance and Legal Department, particularly regarding the rights of FMOS to operate with fairness and independence.

CDD (New Merchant List of March 2025)

As part of my ongoing tasks as a Compliance Trainee, I focused on completing the Customer Due Diligence (CDD) process for round 12 new merchant list for March 2025, which was collected by the Merchant Risk Department. I reviewed 12 new merchants and provided feedback in the comment section, highlighting areas needing improvement. These included correcting typos in business owner and company names, as well as requesting additional or higher-quality supporting documents to ensure compliance with regulatory requirements. I also implement the sanction list checking for BNM-Financial Consumer Alert list, MOHA Sanction List, United Nation Sanction List, Office of Foreign Asset Control (OFAC) List, and Politically Exposure Person List (PEP).

Part 1: Getting Input for ESS Sustainability Report Q1 2025 (QUREX SDN BHD)

To complete the report, I assessed whether any suspicious transactions occurred during Q1 2025 for Qurex Sdn Bhd, as its compliance matters are handled by the same compliance officers as Paydee. The results showed no suspicious transactions from Qurex’s customers. Additionally, all transmitted funds matched the purpose and amount stated in the customer profiles. I documented the findings in the reporting template provided by Farisah, Paydee’s admin officer, via email.

Requested by Farisha, Paydee’s admin officer, I provided input on Qurex’s AML process evidence to serve as proof supporting the AML assessment results stated in the report. This task was originally handled by Sharon, Qurex’s CEO, before I took over.

Policy Document Review from BNM Publication in Kijang Net: Management of Customer Information Permitted Disclosures (MCIPD)

Paydee received the revised Policy Document on Management of Customer Information and Permitted Disclosures (MCIPD) issued by Bank Negara Malaysia (BNM) on 8 April 2025 via the BNM KijangNet website. The document aims to inform Financial Service Providers (FSPs) that BNM has updated the MCIPD to ensure alignment with the Personal Data Protection Act 2010 (PDPA) and to maintain relevance with evolving data protection standards.

Key requirements include:

• 24-hour breach notification: FSPs must notify BNM and affected customers within 24 hours of any data breach that risks significant harm or impacts over 1,000 customers.

• Risk-based reporting: Prioritize critical incidents using a risk-based approach for efficient reporting.

• Feedback submission: Suggestions or alternatives to these requirements must be submitted in writing to BNM via the provided online form by 29 April 2025.

I requested the input for Quarter 1, 2025 from the PICs for each requirement mandated by BNM via the internal email system, including the finance, human resources, and compliance departments. I prepared the input required for the BNM ORR Generic KRI Report Q1 2025 (PII-CI and MAS) by obtaining the following information from the respective departments:

• Number of new litigation cases initiated by REs
  (obtained from Ms. Tan Pei Ru, Legal and Compliance team)

• Staff attrition rate
  (obtained from Ms. Suh Yen, HR department)

• Number of new customer name freeze orders received from enforcement agencies without prior STR raised
  (obtained from Ms. Tan Pei Ru, Legal and Compliance team)

• Number of new audit findings
  (obtained from Ng Song Tai, Finance Department)

Completing BNM ORR Generic KRI Report March 2025:

I requested the input for the March 2025 monthly report from the PICs for each requirement mandated by BNM via the internal email system, including the IT and finance departments. I prepared the input required for the BNM ORR Generic KRI Monthly Report for March 2025 (PII-CI and MAS) by obtaining the following information from the respective departments:

• Number of application fraud near misses
  (obtained from Khairil, Transaction Risk Department)

• Number of reprimands received from other regulators, enforcement agencies, or operators of designated payment systems
  (obtained from Ng Song Tai, Finance Department)

Paydee is required to submit a Data Breach Incident Report for first half April 2025 to Bank Negara Malaysia (BNM) on or by the 15th of every month for second half. The input for this report is collected from the Transaction Risk Department several days before the submission date for proper arrangement. After compiling the required information, I submit the report to BNM via email, following the report format provided by BNM.

Visa Acquirer Merchant Master File (AMMF) - APRIL 2025 Submission

Paydee is required to submit the AMMF report each month on or before the 15th. The necessary input is collected from the Merchant Risk and Operations Department. Once the data is compiled, I submit the report to Visa via email.

MDF Monthly Complaints Resolution Reporting - MARCH 2025 Submission.

Paydee receives an email from EY as a reminder to submit the MDF Monthly Complaints Resolution Report by the 10th calendar day of the month following the reporting month. The required input is collected from the Transaction Risk and Customer Success Departments several days before submission. After gathering all necessary information, I submit the report via email, following the required report format.

Part 2: Ongoing CDD High Risk Merchant MCC (Q1 2025):

I focused on completing the Ongoing Customer Due Diligence (CDD) for High Risk Merchant MCC process for a list of new merchants along quarter 1 2025, which was collected by the Merchant Risk Department. I reviewed 12 high risk merchants mcc and provided feedback in the comment section, highlighting areas that needed improvement. This ongoing CDD implemented to ensure that there's no suspicious or illicit activity run behind the business and ensure compliance with regulatory requirements.

Paydee has received a Policy Document discussing the updated requirements for reporting ORR Loss Event Data (LED) and Key Risk Indicators (KRI) to Bank Negara Malaysia (BNM), issued on 10 April 2025 through the BNM KijangNet website. The aim of this publication is to inform that BNM has updated the KRI technology requirements for ORR reporting submitted to BNM.

The main updates are as follows:

• For KRI 2 Technology, the threshold for network utilization has been changed from 60% to 80%.

• For KRI 5 Technology, the threshold for storage or memory utilization has been changed from 70% to 80%.

  
  

These updates will be effective starting from 1 April 2025 and Quarter 2, 2025, respectively. In addition, BNM has added new clarifications in paragraph 10 regarding the roles and responsibilities of the Group Chief Risk Officer/CRO, Reporting Entities Admins, and Submission Officer. There are also updates regarding the Boundary Data Submission Framework (BDSF) event list

Part 3: Ongoing CDD High Risk Merchant MCC (Q1 2025):

I continued the ongoing Customer Due Diligence (CDD) process for High Risk Merchant MCCs for a list of new merchants collected by the Merchant Risk Department during the first quarter of 2025. I reviewed 10 high-risk merchant MCCs and provided feedback in the comments section, highlighting areas for improvement to ensure there was no suspicious or illicit activity associated with the businesses and to maintain compliance with regulatory requirements.

Correction and Circulate BNM PD Complaints Handling:

This policy document review was corrected and circulated to Song Tai (Finance Manager) and Pei Ru (Legal & Compliance Manager) for their perusal and use.

I collected the list of new customers for the first quarter of 2025. This assessment was conducted by accessing the Money Pro system and downloading information on previous remittance transactions to serve as supporting documents.

ESS Sustainability Reporting

I filled in the data form, including the terms required by AMLA, for both Paydee and Qurex Sdn Bhd as part of the ESS Sustainability Reporting process.

Part 4: Ongoing CDD High Risk Merchant MCC (Q1 2025):

I continued the ongoing Customer Due Diligence (CDD) process for High Risk Merchant MCCs on a list of new merchants provided by the Merchant Risk Department during the first quarter of 2025. I reviewed the remaining 5 high-risk merchant MCCs and provided feedback in the comments section, highlighting areas for improvement to ensure there was no suspicious or illicit activity linked to the businesses and to ensure compliance with regulatory requirements. In total, I have completed the review of 27 out of 63 high-risk merchant MCCs, meeting the requirement to conduct ongoing CDD on at least 30% of the high-risk merchant MCC list.

After collecting input from the person in charge (PIC) for each requirement, I assisted in completing the ESS Sustainability Report for the Business Admin Department. I was required to perform AML business assessment calculations as specified in the ESS Reporting for Q1 2025. Finally, I submitted the input and its supporting documents to Farisha for further action.

I was tasked with extracting all bulletins published up to mid-April from Mastercard-around 70 bulletins labeled as Global (GLB) and Asia Pacific (AP)-which could be applicable to Paydee as a credit card issuer and merchant acquirer. Throughout the day, I managed to review about 14 bulletins, of which 10 were applicable to Paydee and 4 were not. All applicable bulletins that I reviewed have been summarized in the Excel file "Mastercard and Visa Bulletin Review" for circulation to the relevant departments. Additionally, there are 2 bulletins that require immediate action to prevent Paydee from being imposed with charges or fees by Mastercard.

Customer Due Diligence (CDD) for Bagus Pos merchant

My supervisor, Ms. Pei Ru, required me to perform CDD for the Bagus Pos merchant due to several factors that meet high-risk criteria. As a compliance officer, I must focus on assisting with the CDD process by reviewing the documents provided to ensure there are no errors, fraud, or missing compulsory documents.

As a credit card issuer and merchant acquirer, I reviewed around 12 bulletins, of which 9 were applicable to Paydee and 3 were not. All applicable bulletins that I reviewed have been summarized in the Excel file "Mastercard and Visa Bulletin Review" for circulation to the relevant departments. Additionally, there is one bulletin that requires immediate action to avoid Paydee being charged fees by Mastercard, which involves deciding whether to opt in or opt out of a particular service or program.

In the evening, Paydee was visited by two representatives from the OXpay merchant to perform key injection into the payment terminal system provided by Paydee. The key injection took place in the blue meeting room on Level 1 of Paydee’s office. The meeting was attended by three Paydee customer care officers, myself as the Paydee compliance officer, and two representatives from the merchant side.

During the key injection process, the customer care team encountered some issues with the terminal system, but these were resolved with assistance from Haffiz, an experienced officer at Paydee. As the compliance officer, I was required to monitor and witness the process to ensure there were no errors, fraud, or other issues, in accordance with Paydee’s compliance SOPs.

Part 3: MasterCard Bulletin Review (April 2025)

I have finished reviewing around 13 Mastercard bulletins that are applicable to Paydee as a merchant acquirer and credit card issuer. The purpose was to identify any mandates, updates, or guidelines from Mastercard in April that require Paydee to opt in if necessary or opt out if not required, by consulting the PIC for each related department in Paydee. All bulletin reviews for today were recorded in the Excel file for documentation and future circulation.

I reviewed 8 applicable and 2 non-applicable Visa bulletins from March 2025, carefully reading through each to identify the most important information. I summarized the key points, such as updates on payment rules, alerts about suspicious cards, and changes in procedures. Afterward, I organized the summaries based on their urgency and relevance to our operations. This process helps ensure that we remain up to date and compliant with Visa amendment, mandate and guidelines.

Part 4: MasterCard Bulletin Review (April 2025)

I have completed the review of approximately 15 Mastercard bulletins, of which 13 were applicable to Paydee and 2 were not applicable. All applicable bulletins have been recorded in the Excel file and are awaiting further action to be circulated at the end of the month.

I completed the review of 12 Mastercard bulletins for April 2025. Out of these, 11 were relevant to Paydee’s operations, while 1 was not applicable. All applicable bulletins have been documented in the Excel file, where they are pending circulation to the relevant departments at the end of the month.

Paydee is required to submit second half April 2025 Data Breach Incident Report to Bank Negara Malaysia (BNM) by 30th of every month for second half of the month. The input for this report is collected from the Transaction Risk Department several days before the submission date for proper arrangement. After compiling the required information, I submit the report to BNM via email, following the report format provided by BNM.

Part 2: Visa Bulletin Review (April 2025)

I reviewed 11 applicable and 1 non-applicable Visa bulletins from March 2025, carefully reading through each to identify the most important information. I summarized the key points, such as updates on payment rules, alerts about suspicious cards, and changes in procedures. Afterward, I organized the summaries based on their urgency and relevance to our operations. This process helps ensure that we remain up to date and compliant with Visa amendment, mandate and guidelines.

I was circulated the latest list update to Office Foreign Asset Control (OFAC) list of Specially Designated Nationals (SDN) and Blocked Persons. This list was updated for OFAC SDN List Update to list of Counter Terrorism Designations and Designation Update, Iran-related Designation . I was circulated the updated list to the Paydee relevant team which are Merchant Risk Team and Information Technology (IT) Team

Review BNM Publication: Survey of Acquiring Services Offered by Acquirers to Merchants

On 21 April 2025, BNM published a notification regarding a survey applicable to Paydee as a registered merchant acquirer, focusing on offering acquiring services to merchants through KijangNet. The survey must be submitted by the deadline of 21 May 2025. I summarized and circulated the notification to the responsible persons, including my supervisor Ms. Tan Pei Ru, Paydee CEO Darren, and Yoke San, the IT Manager, via the Paydee email system. The objective of the survey is to gain insights into merchant acquiring services, including business practices and relationships with merchants and service providers. Moreover, the data will be kept confidential, and this survey is conducted pursuant to section 143(1) and 143(2) of the FSA 2013, and section 155(1) and 155(2) of the IFSA 2013.

I was circulated the latest list update to Office Foreign Asset Control (OFAC) list of Specially Designated Nationals (SDN) and Blocked Persons. This list was updated for Iran-related Designations. I was circulated the updated list to the Paydee relevant team which are Merchant Risk Team and Information Technology (IT) Team

Part 6: MasterCard Bulletin Review (April 2025)

I completed the review of 3 Mastercard bulletins for April 2025. Out of these, 2 were relevant to Paydee’s operations, while 1 was not applicable. All applicable bulletins have been documented in the Excel file, where they are pending circulation to the relevant departments at the end of the month.

I was circulated the latest list update to Office Foreign Asset Control (OFAC) list of Specially Designated Nationals (SDN) and Blocked Persons. This list was updated for OFAC SDN List Update to list of Counter Terrorism Designations and Designation Update, Iran-related Designation . I was circulated the updated list to the Paydee relevant team which are Merchant Risk Team and Information Technology (IT) Team

Replying Message from Paydee CEO due to Inquiries about Mastercard services/program

Following my email requesting a review and decision from Paydee’s top management on whether to opt in or out of the Mastercard services offered, Darren, Paydee’s CEO, replied asking for further explanation to better understand the services before making a decision. I responded to Darren’s email with advice and support from my supervisor, Ms. Tan Pei Ru, who provided me with insightful information and helpful answers.

As part of my ongoing tasks as a Compliance Trainee, I focused on completing the Customer Due Diligence (CDD) process for a list of new merchants from April 2025 by extract the input, which was requested to the Merchant Risk Department.

Opt-In Fraud Insight Program (MasterCard)

Based on the instruction from Paydee’s CEO, acting on behalf of Paydee Sdn Bhd, I was directed to subscribe to the Mastercard Fraud Insight Program at the standard tier, which imposes no fees or charges and ensures seamless business operations while maintaining compliance with the mandate. I was authorized to complete the opt-in process for Paydee by following the procedures and guidelines provided by Mastercard in their previously published bulletin. I have successfully completed the opt-in process and am now awaiting Mastercard’s response.

I reviewed 8 applicable Visa bulletins from May 2025, carefully reading through each to identify the most important information. I summarized the key points, such as updates on payment rules, alerts about suspicious cards, and changes in procedures. This process helps ensure that we remain up to date and compliant with Mastercard’s guidelines.

OFAC SDN List Updates Circulation

I was circulated the latest list update to Office Foreign Asset Control (OFAC) list of Specially Designated Nationals (SDN) and Blocked Persons. This list was updated for OFAC SDN List Update to list of Burma-related Designations, Transnational Criminal Organization Designations. I was circulated the updated list to the Paydee relevant team which are Merchant Risk and Operation Team and Information Technology (IT) Team.

In April 2025, I reviewed a total of 61 Mastercard and 19 Visa bulletins that applicable to Paydee’s operations. Summaries of these bulletins were prepared and circulated to all related departments within Paydee Sdn Bhd to ensure awareness of the latest updates and necessary compliance actions.

Drafted Email

Several email drafted, in which required to be sent before 15 May for several report submission such as email for requesting input from transaction risk and IT department, email for reporting to BNM, reporting to BNM ORR and so on.

Based on request from merchant risk and operation team, I have been assigned to implement an due diligence process for reviewing Axai Digital Sdn Bhd document to ensure this company perfectly eligible to be payment facilitator under Paydee. The due diligence process been implemented by me likes proceed AML/CFT checking, licenses, transaction statement, CTOS and so on. After that I was passed the updated result from me on behalf compliance team to Lily implement the credit checking for Axai Digital Sdn Bhd and their stakeholder.

Part 1: Conducting CDD process

CDD (New Merchant List of April 2025)

As part of my ongoing tasks as a Compliance Trainee, I focused on completing the Customer Due Diligence (CDD) process for 17 new merchant list for April 2025, which was collected by the Merchant Risk Department. I reviewed 7 over 17 new merchants and provided feedback in the comment section, highlighting areas needing improvement. These included correcting typos in business owner and company names, as well as requesting additional or higher-quality supporting documents to ensure compliance with regulatory requirements. I also implement the sanction list checking for BNM-Financial Consumer Alert list, MOHA Sanction List, United Nation Sanction List, Office of Foreign Asset Control (OFAC) List, and Politically Exposure Person List (PEP).

Monitoring Terminal Injuction Process (Mobility One Sdn Bhd):

In the morning, Paydee was visited by representator from the Mobility One Sdn Bhd merchant to perform key injuction into the payment terminal system provided by Paydee. The key injuction took place in the beige meeting room on Level 1 of Paydee’s office. The meeting was attended by one Paydee customer care officers, myself as the Paydee compliance officer, and one representatives from the merchant side.

There's no issues during the key injuction process, the customer care was implementing the injuction process smoothly into terminal system. As the compliance officer, I was required to monitor and to monitor the process to ensure there were aligned with Paydee’s compliance SOPs.

Part 2: Conducting CDD process

CDD (New Merchant List of April 2025)

I completely finished to do Customer Due Diligence (CDD) process for 10 new merchant from the list for April 2025. I have been reviewed 10 over 17 new merchants today by provide feedback in the comment section, highlighting areas needing improvement. These included requesting for valid document or latest document, CTOS report for several director and management person as well as higher-quality supporting documents to ensure compliance with regulatory requirements. I also implement the sanction list checking for BNM-Financial Consumer Alert list, MOHA Sanction List, United Nation Sanction List, Office of Foreign Asset Control (OFAC) List, and Politically Exposure Person List (PEP).

I have completed the review of the Policy Document on Project STREAM: Modernizing Bank Negara Malaysia's Data Collection with Reporting Entities published by Bank Negara Malaysia (BNM) and ensured Paydee fully informed and understands with the information. Paydee is subjected to this publication due to their status as Approved Issuers of a Designated Payment Instrument. The review was finalized, and an email confirmation was sent to my supervisor.

The Policy Document, issued on 9 May 2025, with aim to announced that BNM implement modernization initiative aimed transformation (from template-based report to STREAM report) in BNM method to collect , processes, and manages data reported within BNM and Reporting Entities (REs) STREAM Project.

OFAC SDN List Updates Circulation

I was circulated the latest list update to Office Foreign Asset Control (OFAC) list of Specially Designated Nationals (SDN) and Blocked Persons. This list was updated for OFAC SDN List Update to list of Proliferation and Iran-related Designations. I was circulated the updated list to the Paydee relevant team which are Merchant Risk and Operation Team and Information Technology (IT) Team.

Visa Acquirer Merchant Master File (AMMF) - MAY 2025 Submission.

Due to mandate from Visa to Paydee, I have submitted the AMMF report for month of May 2025 on 13 May 2025. The necessary input is collected from the Merchant Risk and Operations Department by Hafizin. After getting input and drafting email, the compiled data submitted to Visa via email.

MDF Monthly Complaints Resolution Reporting - APRIL 2025 Submission.

Paydee receives an email from EY as a reminder to submit the MDF Monthly Complaints Resolution Report by the 16th calendar day of the month following the reporting month. The required input is collected from the Transaction Risk and Customer Success Departments several days before submission. After gathering all necessary information, I submit the report via email, following the required report format.

I have submitted the input for the May 2025 monthly report of ORR Generic KRI via BNM Kijang Net from the PICs that was requested via outlook email system. I recorded the input required for the BNM ORR Generic KRI Monthly Report for May 2025 (PII-CI and MAS) by obtaining the following information from the respective departments or PICs:

• Number of application fraud near misses
  (obtained from Khairil, Transaction Risk Department)

• Number of reprimands received from other regulators, enforcement agencies, or operators of designated payment systems. [obtained from Paydee CEO (Darren), Product and Technology Manager (Yoke San), Finance Manager (Song Tai) and Legal Compliance Manager (Pei Ru)].

Revised and amended to "BNM Guidelines Updates Policy" draft

Based on my supervisor's request, I am to revise and make amendments, if needed, to the BNM Guidelines Updates Policy that was drafted by Ms. Tan Pei Ru. The revision should explain in detail the procedure used by Compliance to review and summarize any publications or updates from BNM via the Kijang Net website, and to communicate these to the relevant parties, specifying the type of policy document published and its applicability or target audience.

As the results, I've been revised and added additional information or point into certain part especially in section 8 and 9 for more clarity to give to the Paydee Board of Director (BOD).

Paydee is required to submit first half May 2025 Data Breach Incident Report to Bank Negara Malaysia (BNM) by 15th of every month for first half of the month. The input for this report is collected from the Transaction Risk Department and submitted to BNM via email, following the report format provided by BNM.

Part 1: Track and Record Evidence of Paydee Information Technology (IT) Team Report (April 2025):

• Tracked and recorded evidence of the Paydee Information Technology (IT) Team’s report submission for April 2025 to the ORR BNM report, specifically for the KRI Technology PII-CI report and MAS report.

• Verified that the report inputs were submitted on 15 May 2025 as required.

• Maintained records of submission proof, including the official submission confirmation email generated by Bank Negara Malaysia (BNM) to Reporting Entities, confirming receipt from Paydee Sdn Bhd.

• The report inputs comprised the following terms:

  1. Number of instances where critical services downtime exceeded the Recovery Time Objective (RTO).

  2. Number of instances where network utilization surpassed the 80% threshold.

  3. Number of instances where response times for critical services exceeded predetermined thresholds or Service Level Agreements (SLAs).

  4. Number of hacking attempts detected on the IT infrastructure.

• Ensured proper documentation and evidence retention for audit and compliance purposes related to the April 2025 reporting cycle.

Conducted research on Certified True Copies (CTC) as requested by the Legal and Compliance Manager, Ms. Tan Pei Ru, to address the Credit Department’s query regarding the possibility of waiving the CTC requirement for Identity Cards (NRIC) and three months’ pay slips in the credit card issuance process for Paydee. The initial steps involved gathering as much relevant input related to CTC from BNM policy documents, credible websites, and other sources to obtain advice and gain useful insights. This was done to ensure that the decision and recommendations align with Paydee’s efforts to prevent and reduce fraud cases while increasing sales.

• Tracked and recorded evidence of the Paydee Finance Team’s report submission for April 2025 to the Visa, Mastercard and BNM.

• Verified that the report inputs were submitted following their determined deadlines.

• Maintained records of submission proof, including the official submission confirmation email generated by related principles to reporting entities, confirming receipt from Paydee Sdn Bhd.

• The report inputs comprised by 19 reports required submitted following various across time.

• Ensured proper documentation and evidence retention for audit and compliance purposes related to the April 2025 reporting cycle.

After collecting the input, I began reviewing each piece of information to determine which inputs were useful and contributed to making excellent decisions for Paydee. The goal was to avoid fraudulent issues while establishing a seamless process for verifying related documents and controlling unnecessary business risks.

At the end of this research, I suggested to my Legal and Compliance Manager, Ms. Tan Pei Ru, implementing a hybrid verification method aligned with their risk appetite. This method utilizes CTC for high-risk cases, e-KYC for onboarding/medium-risk cases, and v-KYC for medium-high risk cases.

This approach balances speed and convenience for Paydee clients by waiving CTC in certain situations, but it also acknowledges the potential trade-offs in risk and document verification.

I was circulated the latest list update from Office Foreign Asset Control (OFAC) list of Specially Designated Nationals (SDN) and Blocked Persons. This list was updated for OFAC SDN List Update to list of Counter Narcotics, Counter Terrorism Designations and Designation Update, Venezuela-related Designation Removals. I was circulated the updated list to the Paydee relevant team which are Merchant Risk and Operation Team and Information Technology (IT) Team.

Enhanced Due Diligence: AXAI DIGITAL (Payment Facilitator Document Reviewing)

I have implemented Enhanced Due Diligence for Axai Digital Sdn Bhd due to several issues arising from the documents provided during their onboarding. As the Compliance Officer at Paydee, I must satisfy my inquiries by requiring further clarification and verified documentation regarding the repayment status linked to Axai Digital’s onboarding and registration as a Payment Facilitator (PF) under Mastercard and Visa. This process aims to avoid and minimize potential risk exposure to Paydee, which acts as the principal entity under both card networks.

I have started researching the Payment Facilitator (PF) registration process under Mastercard and Visa. This PF registration focuses on merchant acquiring services provided by Paydee as the principal for both entities, facilitating seamless payment processing for merchants under Paydee.

REQUEST FOR SITE VISIT DATE:

I have emailed the Business Development (BD) and Merchant Risk and Operations teams to directly contact the potential merchants, MOBY MONEY SDN BHD and BAGUS POS SOLUTION SDN BHD, to confirm their availability based on the three proposed dates in different weeks suggested by the Compliance Team for the on-site visit session.

After completing the document review process, I had a meeting with my supervisor to decide on the next steps required to ensure the due diligence process aligns with and is consistent with Paydee’s internal policies.

I have requested the Credit Department to retrieve the company’s and related directors’ CCRIS information in order to obtain clarifications and investigate the related issues.

I was circulated the latest list update from Office Foreign Asset Control (OFAC) list of Specially Designated Nationals (SDN) and Blocked Persons. The publication is regarding OFAC Basics Video Series : Requesting OFAC Guidance and Issuance of Syria General License. I was circulated the updated list to the Paydee relevant team which are Merchant Risk and Operation Team and Information Technology (IT) Team.

PART 2: RESEARCH ON PAYMENT FACILITATOR (PF) ENROLLMENT PROCESS:

Continued researching the Payment Facilitator (PF) registration process under Mastercard and Visa, but at this time I'm focusing on Mastercard procedure and Visa thereafter.

As part of my ongoing tasks as a Compliance Trainee, I focused on completing the Customer Due Diligence (CDD) process for a list of new merchants from May 2025 by extract the input, which was requested to the Merchant Risk Department.

I represented the Compliance team in a meeting with the IT team to gain a better understanding of the new reporting requirements. During the session, the IT team provided an overview and introduction to the updated reporting processes, including the specific forms that need to be submitted. This meeting was valuable in ensuring clear communication and alignment between the Compliance and IT teams moving forward.

Bagus Pos Solution Sdn Bhd is currently in the process of becoming a master merchant under Paydee Sdn Bhd. In accordance with Paydee Sdn Bhd’s internal Customer Due Diligence (CDD) guidelines for onboarding master merchants for acquiring services, the Compliance, Operations, and Business Development teams are required to conduct an on-site visit with each new master merchant. The purpose of this visit is to verify that the merchant’s operations genuinely exist and align with the descriptions provided verbally, visually, and in the submitted documentation.

Circulating Mastercard and Visa Bulletin Review Summary (April 2025)

In April 2025, I reviewed a total of 38 Mastercard and 22 Visa bulletins that applicable to Paydee’s operations. Summaries of these bulletins were prepared and circulated to all related departments within Paydee Sdn Bhd to ensure awareness of the latest updates and necessary compliance actions.

Moby Money Sdn Bhd is currently in the process of becoming a master merchant under Paydee Sdn Bhd. In accordance with Paydee Sdn Bhd’s internal Customer Due Diligence (CDD) guidelines for onboarding master merchants for acquiring services, the Compliance, Operations, and Business Development teams are required to conduct an on-site visit with each new master merchant. The purpose of this visit is to verify that the merchant’s operations genuinely exist and align with the descriptions provided verbally, visually, and in the submitted documentation.

The site visit agenda was fully documented in a report, summarizing key findings, discussions, and revalidating the required document checklist from the onboarding team. This report will be escalated to the Paydee Sdn Bhd CEO for review during the board meeting.

The site visit agenda was fully documented in a report, summarizing key findings, discussions, and revalidating the required document checklist from the onboarding team. This report will be escalated to the Paydee Sdn Bhd CEO for review during the board meeting.

CDD (New Merchant List of May 2025)

As part of my ongoing tasks as a Compliance Trainee, I focused on completing the Customer Due Diligence (CDD) process for 25 new merchant list for April 2025, which was collected by the Merchant Risk Department. I reviewed 12 over 25 new merchants and provided feedback in the comment section, highlighting areas needing improvement. These included correcting typos in business owner and company names, as well as requesting additional or higher-quality supporting documents to ensure compliance with regulatory requirements.

Conducted sanction list screening based on BNM-Financial Consumer Alert list, MOHA Sanction List, United Nation Sanction List, Office of Foreign Asset Control (OFAC) List, and Politically Exposure Person List (PEP).

Visa Acquirer Merchant Master File (AMMF) - JUNE 2025 Submission

Paydee is required to submit the AMMF report each month on or before the 15th. The necessary input is collected from the Merchant Risk and Operations Department. Once the data is compiled, I submit the report to Visa via email.

MDF Monthly Complaints Resolution Reporting - MAY 2025 Submission.

Paydee receives an email from EY as a reminder to submit the MDF Monthly Complaints Resolution Report by the certain date or calendar day of the month following the reporting month. The required input is collected from the Transaction Risk and Customer Success Departments several days before submission. After gathering all necessary information, I submit the report via email, following the required report format.

Completing BNM ORR Generic KRI Report May 2025:

I requested the input for the May 2025 monthly report from the PICs for each requirement mandated by BNM via the internal email system, including the IT and finance departments. I prepared the input required for the BNM ORR Generic KRI Monthly Report for May 2025 (PII-CI and MAS) by obtaining the following information from the respective departments:

• Number of application fraud near misses
  (obtained from Khairil, Transaction Risk Department)

• Number of reprimands received from other regulators, enforcement agencies, or operators of designated payment systems
  (obtained from Ng Song Tai, Finance Department)

CDD (New Merchant List of May 2025)

As part of my ongoing tasks as a Compliance Trainee, I focused on completing the Customer Due Diligence (CDD) process for 25 new merchant list for April 2025, which was collected by the Merchant Risk Department. I reviewed 13 over 25 new merchants and provided feedback in the comment section, highlighting areas needing improvement. These included correcting typos in business owner and company names, as well as requesting additional or higher-quality supporting documents to ensure compliance with regulatory requirements.

I have requested to become a submitter of client documents on the Visa Access website to ensure the enrollment process for Payment Facilitators or Third Party Agent (TPA) under Visa.

I was circulated the latest list update from Office Foreign Asset Control (OFAC) list of Specially Designated Nationals (SDN) and Blocked Persons. The publication is regarding Balkans-related, Counter Narcotics, and Russia-related Designations Removals. I was circulated the updated list to the Paydee relevant team which are Merchant Risk and Operation Team and Information Technology (IT) Team.

COMPLIANCE CHECKLIST FOR CORPORATE CREDIT CARD:

I was mandated by my Legal and Compliance Manager to create a compliance checklist for new product development on behalf of the compliance team for the corporate credit card product that will be launched soon. I need to conduct research and consider several factors that may have a significant impact on the new product development by referring to the latest policy documents to ensure compliance with AML/CFT guidelines and mandates.

I have submitted to BNM by providing input for second half May 2025 Data Breach Incident Report. The input for this report is collected from the Transaction Risk Department several days before the submission date for proper arrangement. After compiling the required information, I submit the report to BNM via email, following the report format provided by BNM.

REQUEST ACCESS AS PAYMENT FACILITATOR (PF) SUBMITTER OF MASTERCARD:

I have requested to become a submitter of client documents on the Mastercard Connect website to ensure the enrollment process for Payment Facilitators or Service Providers under Mastercard.

Paydee is required to submit second half May 2025 Data Breach Incident Report to Bank Negara Malaysia (BNM) by 30th of every month for second half of the month. The input for this report is collected from the Transaction Risk Department several days before the submission date for proper arrangement. After compiling the required information, I submit the report to BNM via email, following the report format provided by BNM.

PAYMENT FACILITATOR (PF) DUE DILIGENCE: CHIP IN SDN BHD

I have implemented the Customer Due Diligence (CDD) process for Paydee’s current master merchant, CHIP IN SDN BHD, which is enrolled in the PF services and must go through the onboarding process before being officially registered as a Payment Facilitator for merchant acquiring services under Paydee.

I reviewed 7 applicable Visa bulletins from June 2025, carefully reading through each to identify the most important information. I summarized the key points, such as updates on payment rules, alerts about suspicious cards, and changes in procedures. This process helps ensure that we remain up to date and compliant with Mastercard’s guidelines.

I reviewed 6 applicable Visa bulletins from June 2025, carefully reading through each to identify the most important information. I summarized the key points, such as updates on payment rules, alerts about suspicious cards, and changes in procedures. This process helps ensure that we remain up to date and compliant with Mastercard’s guidelines.

OFAC SDN List Updates Circulation

I was circulated the latest list update to Office Foreign Asset Control (OFAC) list of Specially Designated Nationals (SDN) and Blocked Persons. I was circulated the updated list to the Paydee relevant team which are Merchant Risk and Operation Team and Information Technology (IT) Team.

I completed the review of 20 Mastercard bulletins for June 2025, which were relevant to Paydee’s operations. All applicable bulletins have been documented in the Excel file, where they are pending circulation to the relevant departments at the end of the month.

Conducted a site visit to Paydee master merchant Chip In Sdn Bhd, as the company is migrating to become a Payment Facilitator (PF) under Paydee. The site visit is part of the comprehensive due diligence process. Chip In Sdn Bhd is currently in the process of becoming a master merchant under Paydee Sdn Bhd. In accordance with Paydee’s internal Customer Due Diligence (CDD) guidelines for onboarding Payment Facilitators for acquiring services, the Compliance, Operations, and Business Development teams are required to conduct an on-site visit with each new Payment Facilitator (PF). The purpose of this visit is to verify that the PF’s operations genuinely exist and are consistent with the descriptions provided verbally, visually, and through the submitted documentation.

OFAC SDN List Updates Circulation

I was circulated the latest list update to Office Foreign Asset Control (OFAC) list of Specially Designated Nationals (SDN) and Blocked Persons. I was circulated the updated list to the Paydee relevant team which are Merchant Risk and Operation Team and Information Technology (IT) Team.

SITE VISIT REPORT PREPARATION: CHIP IN SDN BHD

The site visit agenda was fully documented in a report, summarizing key findings, discussions, and revalidating the required document checklist from the onboarding team. This report will be escalated to the Paydee Sdn Bhd CEO for review during the board meeting.

I completed the review of 10 Mastercard bulletins for June 2025, which were relevant to Paydee’s operations. All applicable bulletins have been documented in the Excel file, where they are pending circulation to the relevant departments at the end of the month.

I was circulated the latest list update to Office Foreign Asset Control (OFAC) list of Specially Designated Nationals (SDN) and Blocked Persons. This list was updated for OFAC SDN List Update to list of Non-Proliferation Designations; Iran-related and Counter Terrorism Designations, Designation Updates, and Designation Removal. I was circulated the updated list to the Paydee relevant team which are Merchant Risk Team and Information Technology (IT) Team

Part 3: MasterCard Bulletin Review (June 2025)

I completed the review of 12 Mastercard bulletins for June 2025, which were relevant to Paydee’s operations. All applicable bulletins have been documented in the Excel file, where they are pending circulation to the relevant departments at the end of the month.

I completed the review of 10 Mastercard bulletins for June 2025, which were relevant to Paydee’s operations. All applicable bulletins have been documented in the Excel file, where they are pending circulation to the relevant departments at the end of the month.

Submit PF Site Visit Report to Credit Team: CHIP IN SDN BHD

Part 5: MasterCard Bulletin Review (June 2025)

I completed the review of 12 Mastercard bulletins for June 2025, which were relevant to Paydee’s operations. All applicable bulletins have been documented in the Excel file, where they are pending circulation to the relevant departments at the end of the month.

Submission Input Data Breach Incident Report (2nd Half June 2025)

I have submitted to BNM by providing input for second half June 2025 Data Breach Incident Report. The input for this report is collected from the Transaction Risk Department several days before the submission date for proper arrangement. After compiling the required information, I submit the report to BNM via email, following the report format provided by BNM.

Whistleblowing Report Q1 Paydee and Qurex Submission

Submitted Whistleblowing form to the Board Management for their perusal and use.

Conducted a site visit to Paydee master merchant AXAI DIGITAL SDN BHD, as the company is migrating to become a Payment Facilitator (PF) under Paydee. The site visit is part of the comprehensive due diligence process. AXAI DIGITAL SDN BHD is currently in the process of becoming a master merchant under Paydee Sdn Bhd. In accordance with Paydee’s internal Customer Due Diligence (CDD) guidelines for onboarding Payment Facilitators for acquiring services, the Compliance, Operations, and Business Development teams are required to conduct an on-site visit with each new Payment Facilitator (PF). The purpose of this visit is to verify that the PF’s operations genuinely exist and are consistent with the descriptions provided verbally, visually, and through the submitted documentation.

I was circulated the latest list update to Office Foreign Asset Control (OFAC) list of Specially Designated Nationals (SDN) and Blocked Persons. I was circulated the updated list to the Paydee relevant team which are Merchant Risk and Operation Team and Information Technology (IT) Team.

Monitoring Terminal Injuction Process (Alpha Fintech Sdn Bhd):

In the morning, Paydee was visited by representator from the Alpha Fintech Sdn Bhd merchant to perform key injuction into the payment terminal system provided by Paydee. The key injuction took place in the beige meeting room on Level 1 of Paydee’s office. The meeting was attended by one Paydee customer care officers, myself as the Paydee compliance officer, and one representatives from the merchant side.

There's no issues during the key injuction process, the customer care was implementing the injuction process smoothly into terminal system. As the compliance officer, I was required to monitor the process to ensure there were aligned with Paydee’s compliance SOPs.

In June 2025, I reviewed a total of 49 Mastercard and 15 Visa bulletins that applicable to Paydee’s operations. Summaries of these bulletins were prepared and circulated to all related departments within Paydee Sdn Bhd to ensure awareness of the latest updates and necessary compliance actions.

In the morning, Paydee was visited by representator from the Share Commerce Sdn Bhd merchant to perform key injuction into the payment terminal system provided by Paydee. The key injuction took place in the beige meeting room on Level 1 of Paydee’s office. The meeting was attended by one Paydee customer care officers, myself as the Paydee compliance officer, and one representatives from the merchant side.

There's no issues during the key injuction process, the customer care was implementing the injuction process smoothly into terminal system. As the compliance officer, I was required to monitor the process to ensure there were aligned with Paydee’s compliance SOPs.

I have requested input from the Product Operations Department containing the list of high-risk merchants for Q2 2025 (April–June 2025) and the list of active transaction merchants in order to conduct ongoing CDD on the high-risk merchants.

The site visit agenda was fully documented in a report, summarizing key findings, discussions, and revalidating the required document checklist from the onboarding team. This report will be escalated to the Paydee Sdn Bhd CEO for review during the board meeting.

CYBERSECURITY AWARENESS TRAINING Q2 2025:

The IT team has implemented cybersecurity awareness training to enhance the understanding of Paydee staff about the importance of following standards and guidelines during the execution of assigned tasks and routines. Since Paydee is a fintech company in Malaysia, this training is essential. At the end of the session, there is a compulsory quiz that all Paydee staff must complete.

As a Compliance Officer, I am required to complete the Enhanced Due Diligence (EDD) process for the high-risk merchant list for Quarter 2. This involves generating the comprehensive 4XLAB report detailing risk assessments and relevant information on these merchants. The report will be submitted to stakeholders and company management to ensure full compliance with regulatory requirements and internal policies concerning high-risk entities. The EDD process aligns with regulatory guidelines by conducting thorough verification, source of funds validation, background checks, and ongoing monitoring to mitigate risks related to money laundering and financial crimes.

I focused on completing the Ongoing Customer Due Diligence (CDD) for High Risk Merchant MCC process for a list of new merchants along quarter 2 2025, which was collected by the Merchant Risk Department. I reviewed 15 high risk merchants mcc and provided feedback in the comment section, highlighting areas that needed improvement. This ongoing CDD implemented to ensure that there's no suspicious or illicit activity run behind the business and ensure compliance with regulatory requirements.

I focused on completing the Ongoing Customer Due Diligence (CDD) for High Risk Merchant MCC process for a list of new merchants along quarter 2 2025, which was collected by the Merchant Risk Department. I reviewed 18 high risk merchants mcc and provided feedback in the comment section, highlighting areas that needed improvement. This ongoing CDD implemented to ensure that there's no suspicious or illicit activity run behind the business and ensure compliance with regulatory requirements.

CDD (New Merchant List of June 2025)

As part of my ongoing tasks as a Compliance Trainee, I focused on completing the Customer Due Diligence (CDD) process for 28 new merchant list for June 2025, which was collected by the Merchant Risk Department. I reviewed 10 over 28 new merchants and provided feedback in the comment section, highlighting areas needing improvement. These included correcting typos in business owner and company names, as well as requesting additional or higher-quality supporting documents to ensure compliance with regulatory requirements.

Part 1: Visa Bulletin Review (July 2025)

I reviewed 8 applicable Visa bulletins from July 2025, carefully reading through each to identify the most important information. I summarized the key points, such as updates on payment rules, alerts about suspicious cards, and changes in procedures. This process helps ensure that we remain up to date and compliant with Mastercard’s guidelines.

CDD (New Merchant List of June 2025)

As part of my ongoing tasks as a Compliance Trainee, I focused on completing the Customer Due Diligence (CDD) process for 28 new merchant list for June 2025, which was collected by the Merchant Risk Department. I reviewed 18 over 28 new merchants and provided feedback in the comment section, highlighting areas needing improvement. These included correcting typos in business owner and company names, as well as requesting additional or higher-quality supporting documents to ensure compliance with regulatory requirements.

I reviewed and analyzed MasterCard bulletins published in July 2025 to identify any amendments or information requiring further action. I selected bulletins labeled "Asia Pacific (AP)" or "Global (GLB)" due to their relevance to Paydee as a merchant acquirer and credit card issuer in Malaysia. I reviewed 14 applicable bulletins and 5 non-applicable ones. After summarizing the key points, I recorded the information in an Excel file and circulated both the summary and the original bulletin files to all relevant departments at Paydee via Outlook 2007 email.

I requested the input for Quarter 2, 2025 from the PICs for each requirement mandated by BNM via the internal email system, including the finance, human resources, and compliance departments. I prepared the input required for the BNM ORR Generic KRI Report Q2 2025 (PII-CI and MAS) by obtaining the following information from the respective departments:

• Number of new litigation cases initiated by REs
  (obtained from Mr. Darren CEO)

• Staff attrition rate
  (obtained from Ms. Syahirah, HR department)

• Number of new customer name freeze orders received from enforcement agencies without prior STR raised
  (obtained from Mr. Darren CEO)

• Number of new audit findings
  (obtained from Ng Song Tai, Finance Department)

Completing BNM ORR Generic KRI Report June 2025:

I requested the input for the June 2025 monthly report from the PICs for each requirement mandated by BNM via the internal email system, including the IT and finance departments. I prepared the input required for the BNM ORR Generic KRI Monthly Report for June 2025 (PII-CI and MAS) by obtaining the following information from the respective departments:

• Number of application fraud near misses
  (obtained from Khairil, Transaction Risk Department)

• Number of reprimands received from other regulators, enforcement agencies, or operators of designated payment systems
  (obtained from Ng Song Tai, Finance Department)

Data Breach Incident Report - 1st Half JULY2025

Paydee is required to submit a Data Breach Incident Report for first half July 2025 to Bank Negara Malaysia (BNM) on or by the 15th of every month for first half. The input for this report is collected from the Transaction Risk Department several days before the submission date for proper arrangement. After compiling the required information, I submit the report to BNM via email, following the report format provided by BNM.

Conducted sanction list screening based on BNM-Financial Consumer Alert list, MOHA Sanction List, United Nation Sanction List, Office of Foreign Asset Control (OFAC) List, and Politically Exposure Person List (PEP).

Since Paydee has decided to subscribe to new features from Visa through the Visa Access program for yearly renewal, the Visa University feature will be utilized to provide comprehensive training and educational resources.

This platform is designed to enhance the team's knowledge of Visa’s payment products, compliance requirements, and industry best practices, ensuring that Paydee remains up-to-date with the latest developments and maintains regulatory compliance.

On my final day as an intern at Paydee , I returned all company-provided equipment, including the laptop, screen monitor, mouse, and associated wiring. Each item was returned in good condition, as required. The return process involved completing several forms and submitting feedback to both the Paydee IT and HR teams.